The Avada (Fusion) Builder plugin for WordPress contains a flaw that allows authorized users with Subscriber level or higher to trigger any registered WordPress action hook through the Dynamic Data feature. By supplying crafted input to the plugin's output_action_hook function, an attacker can immediately execute any available hook, leading to privilege escalation, file inclusion, denial of service, or other exploits depending on the hooks present in the installation. The weakness is a classic code injection vulnerability (CWE-94).

WordPress sites that have the Avada (Fusion) Builder plugin installed, versions based on or earlier than 3.15.1. The vulnerability is vendor specific to themefusion:Avada (Fusion) Builder and applies to every installation containing that plugin at a vulnerable version.

The CVSS score for this vulnerability is 5.4, indicating a medium severity. No EPSS score is currently available, and the vulnerability is not listed in the CISA KEV catalog. The only prerequisite for exploitation is that the attacker is authenticated with at least Subscriber privileges, and that a WordPress action hook is registered in the site. The likely attack vector is through the plugin's administrative interface or API where Dynamic Data requests can be formed by an authenticated user. Given the medium score and lack of publicly known exploits, the overall risk remains moderate but requires timely remediation.